Eliminate ${VAR} substitutions from docker-compose.yml

Move DATABASE_URL, ADMIN_TOKEN, ARTDAG_CLUSTER_KEY to .env
and use env_file on all services. This means docker stack deploy
no longer needs env vars sourced in the shell, and repeat deploys
won't trigger spurious restarts on unchanged services.

GPU worker gets its own .env.gpu with fully resolved cross-VPC URLs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -21,9 +21,10 @@ services:
 
   postgres:
     image: postgres:16-alpine
+    env_file:
+      - .env
     environment:
       - POSTGRES_USER=artdag
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=artdag
     ports:
       - target: 5432
@@ -69,16 +70,10 @@ services:
       - .env
     environment:
       - REDIS_URL=redis://redis:6379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@postgres:5432/artdag
-      - ADMIN_TOKEN=${ADMIN_TOKEN}
       # IPFS_API multiaddr - used for all IPFS operations (add, cat, pin)
       - IPFS_API=/dns/ipfs/tcp/5001
       - CACHE_DIR=/data/cache
-      # Set IPFS_PRIMARY=true to use IPFS-primary mode (everything on IPFS, no local cache)
-      # - IPFS_PRIMARY=true
-      # Cluster key for trust domains - systems with same key can share work via IPFS
-      # Generate with: openssl rand -hex 32
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
+      # DATABASE_URL, ADMIN_TOKEN, ARTDAG_CLUSTER_KEY,
       # L2_SERVER, L2_DOMAIN, IPFS_GATEWAY_URL from .env file
     volumes:
       - l1_cache:/data/cache
@@ -100,15 +95,15 @@ services:
   l1-worker:
     image: registry.rose-ash.com:5000/celery-l1-server:latest
     command: sh -c "find /app -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null; celery -A celery_app worker --loglevel=info -E"
+    env_file:
+      - .env
     environment:
       - REDIS_URL=redis://redis:6379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@postgres:5432/artdag
       # IPFS_API multiaddr - used for all IPFS operations (add, cat, pin)
       - IPFS_API=/dns/ipfs/tcp/5001
       - CACHE_DIR=/data/cache
       - C_FORCE_ROOT=true
-      # Must match l1-server for consistent cache_ids
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
+      # DATABASE_URL, ARTDAG_CLUSTER_KEY from .env file
     volumes:
       - l1_cache:/data/cache
     depends_on:
@@ -149,29 +144,9 @@ services:
   # Requires: docker node update --label-add gpu=true <gpu-node-name>
   l1-gpu-worker:
     image: registry.rose-ash.com:5000/celery-l1-gpu-server:latest
-    # For local dev, uncomment to build from Dockerfile.gpu:
-    # build:
-    #   context: .
-    #   dockerfile: Dockerfile.gpu
     command: sh -c "cd /app && celery -A celery_app worker --loglevel=info -E -Q gpu,celery"
-    environment:
-      # GPU node is on different VPC - use public IPs for cross-node communication
-      - REDIS_URL=redis://${L1_HOST}:16379/5
-      - DATABASE_URL=postgresql://artdag:${POSTGRES_PASSWORD}@${L1_HOST}:15432/artdag
-      # Connect to shared IPFS node on CPU (via public IP)
-      - IPFS_API=/ip4/${L1_HOST}/tcp/15001
-      # Gateway fallback for resilience
-      - IPFS_GATEWAYS=https://ipfs.io,https://cloudflare-ipfs.com,https://dweb.link
-      # Local cache is ephemeral (tmpfs or local volume)
-      - CACHE_DIR=/data/cache
-      - C_FORCE_ROOT=true
-      - ARTDAG_CLUSTER_KEY=${ARTDAG_CLUSTER_KEY:-}
-      # GPU acceleration settings
-      - NVIDIA_VISIBLE_DEVICES=all
-      # GPU persistence disabled until all primitives support GPU frames
-      - STREAMING_GPU_PERSIST=0
-      # Use our public IPFS gateway for HLS segment URLs
-      - IPFS_GATEWAY_URL=https://celery-artdag.rose-ash.com/ipfs
+    env_file:
+      - .env.gpu
     volumes:
       # Local cache - ephemeral, just for working files
       - gpu_cache:/data/cache